ECJ to decide whether consumer protection agencies may issue data protection warnings

The Federal Court of Justice (BGH) currently has to decide whether a breach by the operator of a social network of the obligation under data protection law to inform the users of this network about the scope and purpose of the collection and use of their data gives rise to claims for injunctive relief under competition law and can be pursued by consumer protection associations by means of an action before the civil courts.

Facts:

The defendant, Facebook Ireland Limited, based in Ireland, operates the social network “Facebook”. On the Internet platform of this network, there is an “App Center” in which the defendant makes online games of other providers available to the users of its platform free of charge. In November 2012, several games were offered in this app center, where the following instructions could be read under the button “Play immediately”: “By clicking on ‘Play game” above, this application receives: Your general information, Your email address, About you, Your status messages. This application may post on your behalf, including your score and more.” For one game, the notices ended with the sentence, “This application may post status messages, photos, and more on your behalf.”

The plaintiff is the umbrella organization of the consumer centers of the German states. He objects to the presentation of the notices given under the “Play Now” button in the app center as unfair from the point of view of, among other things, a breach of law due to a violation of legal requirements for obtaining effective consent from the user under data protection law. Furthermore, it considers the concluding note in a game to be a general business condition that unreasonably disadvantages the user. It shall hold itself out for the assertion of claims for injunctive relief by way of action before the civil courts pursuant to Section 8 para. 3 No. 3 UWG and § 3 para. 1 sentence 1 no. 1 UKlaG.

Previous process history:

The Regional Court ordered the defendant, as requested, to refrain from presenting games on its website in an app center in such a way that users of the Internet platform, by clicking a button such as “Play game”, make the declaration that the operator of the game receives information about the personal data stored there via the social network operated by the defendant and is authorized to transmit (post) information on behalf of the users. The defendant’s appeal was unsuccessful. In its appeal, which was allowed by the Court of Appeal, the defendant continues to pursue its motion to dismiss the action.

The decision of the Federal Supreme Court:

The Federal Court of Justice stayed the proceedings and referred the question to the Court of Justice of the European Union for a preliminary ruling as to whether the provisions of Chapter VIII, in particular Art. 80 para. 1 and 2 and Art. 84 para. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation) preclude national regulations which – in addition to the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the Regulation and the legal protection options of the data subjects – grant competitors on the one hand and associations, bodies and chambers authorized under national law on the other hand the power to take action against the infringer by way of an action before the civil courts for infringements of the General Data Protection Regulation irrespective of the infringement of specific rights of individual data subjects and without the mandate of a data subject.

This question is disputed in the case law of the courts of instance and in the legal literature.

It is argued that the General Data Protection Regulation contains a final regulation for the enforcement of the provisions of data protection law made in this Regulation and that associations therefore only have a right of action under the conditions of Article 80 of the General Data Protection Regulation – which were not met in the case in question. Others do not consider the provisions made in the General Data Protection Regulation for the enforcement of rights to be conclusive and associations therefore continue to be authorized to enforce claims for injunctive relief on account of the infringement of data protection provisions by way of action before the civil courts, irrespective of the infringement of specific rights of individual data subjects and without a mandate from a data subject.

The Court of Justice of the European Union has already ruled that the provisions of Directive 95/46/EC (Data Protection Directive) – which was applicable until the entry into force of the General Data Protection Regulation on May 25, 2018 – do not preclude associations from bringing an action (judgment of July 29, 2019 – C-40/17). However, it is not clear from this decision whether this right of action continues to apply under the General Data Protection Regulation, which has replaced the Data Protection Directive.